KCA study plan

KCA · Give each week a clear focus.

8 weeks · About 6 hours per week

Week 1

Kubernetes Core Concepts

Stand up a single-node cluster with kubeadm or kind and verify every control-plane component is Running
Label and annotate namespaces, pods, and nodes, then select them with label queries and field selectors
Explain the reconciliation loop by deleting a pod owned by a Deployment and observing replacement
Map the lifecycle of a Pod from Pending to Running to Terminating using kubectl describe and events

A one-page cheat sheet of kubectl verbs plus a screenshot-free text log showing a pod's full lifecycle events from your own cluster

Week 2

Create Deployments, ReplicaSets, and StatefulSets and articulate when each is appropriate
Configure liveness, readiness, and startup probes and predict the effect of each failing
Mount ConfigMaps and Secrets as env vars and as volumes, then compare update propagation
Write and apply a multi-resource manifest with a namespace, ServiceAccount, Deployment, and Service

A repository folder of four manifests that each deploy cleanly into a fresh namespace with kubectl apply -f, plus a written note on probe behavior

Week 3

Provision a multi-node cluster from scratch and record every prerequisite step
Inspect static pod manifests and the kubelet config on each node
Run cluster validation checks covering node readiness, DNS, and API server health
Perform a controlled upgrade of one minor version and roll back a failed upgrade attempt

A step-by-step install runbook you followed end to end, including the exact commands and the validation output proving a healthy cluster

Week 4

Configure RBAC Roles, ClusterRoles, and bindings and prove access with kubectl auth can-i
Create a ServiceAccount with a scoped token and use it from a pod
Apply Pod Security Standards at namespace level and observe admission rejections
Harden a workload with runAsNonRoot, readOnlyRootFilesystem, and dropped capabilities

A security lab write-up showing a denied request, an allowed request, and a hardened pod spec that still passes its readiness probe

Week 5

Trace traffic from an external client through a Service to a pod using ClusterIP, NodePort, and LoadBalancer
Deploy a NetworkPolicy that blocks all ingress except from one labeled namespace and verify the block
Configure CoreDNS behavior and debug a service-name resolution failure
Explain how kube-proxy modes differ in packet handling for a Service

A connectivity matrix table you filled in by testing each Service type and policy combination, with pass/fail results from your own cluster

Week 6

Diagnose a CrashLoopBackOff by reading logs, previous-container logs, and events
Resolve an ImagePullBackOff caused by a private registry credential problem
Recover a node stuck in NotReady by checking kubelet status, certificates, and disk pressure
Debug a Pending pod caused by insufficient resources or an unsatisfied node selector

A troubleshooting journal of five deliberately injected failures, each with symptom, root cause, fix, and verification command

Week 7

Set requests and limits and observe eviction and OOMKilled behavior under memory pressure
Control placement with nodeSelector, affinity, and anti-affinity rules
Create taints on a node and add the matching toleration to a workload
Configure a HorizontalPodAutoscaler and trigger scaling with a load generator
Define a PodDisruptionBudget and confirm it constrains a node drain

A scheduling experiment report showing before-and-after node placement for each mechanism, with the HPA scaling event captured in text

Week 8

Complete a timed full-cluster rebuild from an empty VM to a working Deployment behind a Service
Repair three broken manifests under time pressure without consulting notes
Audit your cluster against a security checklist covering RBAC, secrets, and pod hardening
Review every domain's weak spots and re-run the labs that failed

A timed dry run completed in under 90 minutes with a pass/fail checklist per domain and a short list of remaining gaps

Week 2: You can deploy, expose, and inspect any core workload without looking up kubectl syntax

Week 4: You have built a cluster from scratch twice and can prove RBAC denial and pod hardening with command output

Week 6: You have diagnosed five distinct failure modes from symptoms alone and documented each fix

Week 8: You completed a full timed rebuild plus three manifest repairs and scored your own results per domain